CVE-2025-52938 Potential heap-based buffer over-read vulnerability in NotepadNext

Out-of-bounds Read vulnerability in dail8859 NotepadNext src/lua/src modules. This vulnerability is associated with program files lparser.C. This issue affects NotepadNext: through v0.11. The singlevar in lparser.c lacks a certain luaKexp2anyregup call, leading to a heap-based buffer over-read th...

CVE-2025-52938 Potential heap-based buffer over-read vulnerability in NotepadNext

Out-of-bounds Read vulnerability in dail8859 NotepadNext src/lua/src modules. This vulnerability is associated with program files lparser.C. This issue affects NotepadNext: through v0.11. The singlevar in lparser.c lacks a certain luaKexp2anyregup call, leading to a heap-based buffer over-read th...

CVE-2025-52938

CVE-2025-52938 affects NotepadNext up to v0.11. The vulnerability is an out-of-bounds read in the Lua parser module, specifically the function singlevar() in lparser.c, where a required luaK_exp2anyregup call is missing. This can cause a heap-based buffer over-read when untrusted Lua code is comp...

Exploit for Authentication Bypass by Spoofing in Apache Apisix

Apache APISIX 2.12.x Remote Code Execution RCE Exploit This...

AZL-55286 CVE-2024-46981 affecting package valkey for versions less than 8.0.2-1

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate...

Important: redis

Issue Overview: Denial-of-service due to unbounded pattern matching CVE-2024-31228 Lua library commands may be exploited by an authenticated user to achieve remote-code-execution CVE-2024-31449 Affected Packages: redis Note: This advisory is applicable to Amazon Linux 2 - Redis6 Extra. Visit this...

Important: redis6

Issue Overview: Denial-of-service due to unbounded pattern matching CVE-2024-31228 Lua library commands may be exploited by an authenticated user to achieve remote-code-execution CVE-2024-31449 Affected Packages: redis6 Issue Correction: Run dnf update redis6 --releasever 2023.5.20241001 or dnf...

CVE-2023-52252

Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint...

CVE-2023-52252

Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint...

CVE-2023-52252

Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint...

Design/Logic Flaw

Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint...

Unified Remote Security Vulnerability

Unified Remote is a smartphone application that enables a cell phone to become a wireless universal remote control. A security vulnerability exists in Unified Remote version 3.13.0, which stems from a security issue in the wildcard Access-Control-Allow-Origin for remote upload endpoints, allowing...

CVE-2023-52252

Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint...

PT-2023-31943 · Unknown · Unified Remote

Name of the Vulnerable Software and Affected Versions: Unified Remote version 3.13.0 Description: The issue allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the "Remote upload endpoint". Recommendations: For Unified Remote version 3.13....

Design/Logic Flaw

In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section...

CVE-2023-35853

In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section...

CVE-2023-35853

In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section...

Improper Input Validation

freedroidrpg:sid is vulnerable to Improper Input Validation. files within 'savestructinternal.c' where save game data is composed can be modified to add in any lua code which can lead to arbitrary code execution when loading...

SUSE: Security Advisory (SUSE-SU-2022:1929-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:1929-1 Security update for redis

This update for redis fixes the following issues: - CVE-2022-24735: Fixed Lua code injection bsc1198952. - CVE-2022-24736: Fixed Lua NULL pointer dereference bsc1198953...